安全测试

# 以 Docker 方式对测试环境做基线扫描（被动为主，输出 HTML 报告）
docker run -t zaproxy/zap-stable zap-baseline.py \
  -t https://test.example.com -r zap-report.html

# 安装 Nuclei
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# 用模板扫描目标
nuclei -u https://example.com -t cves/

# templates/custom-xss.yaml 自定义模板
id: custom-xss-test
info:
  name: Custom XSS Test
  severity: medium
http:
  - method: POST
    path:
      - "{{BaseURL}}/api/comments"
    body: 'content=<script>alert(1)</script>'
    matchers:
      - type: word
        words:
          - "<script>alert(1)</script>"
        negative: true

# 检测指定请求是否存在注入（-r 可复用抓包保存的原始请求）
sqlmap -u "https://test.example.com/items?id=1" --batch

# 指定参数与数据库类型，提高检测效率
sqlmap -u "https://test.example.com/items?id=1" \
  -p id --dbms=mysql --level=3

# SQL 注入测试用例
sql_injection_payloads = [
    # 经典注入
    "' OR '1'='1",
    "' OR '1'='1' --",
    "' OR '1'='1' /*",
    "1' UNION SELECT NULL--",
    "1' UNION SELECT username,password FROM users--",

    # 盲注
    "' AND 1=1--",
    "' AND 1=2--",
    "' AND SLEEP(5)--",

    # 编码绕过
    "%27%20OR%20%271%27%3D%271",
    "1%27%20UNION%20SELECT%20NULL--",
]

def test_sql_injection(base_url):
    """测试登录接口的 SQL 注入"""
    for payload in sql_injection_payloads:
        response = requests.post(
            f"{base_url}/api/login",
            json={"username": payload, "password": "any"}
        )
        # 不应返回 200（成功登录）
        assert response.status_code != 200, f"SQL注入成功: {payload}"
        # 不应泄露数据库错误信息
        assert "SQL" not in response.text
        assert "syntax error" not in response.text.lower()

xss_payloads = [
    '<script>alert("XSS")</script>',
    '<img src=x onerror=alert("XSS")>',
    '"><script>alert("XSS")</script>',
    "'-alert('XSS')-'",
    '<svg/onload=alert("XSS")>',
    'javascript:alert("XSS")',
]

def test_xss(base_url):
    """测试评论接口的 XSS"""
    for payload in xss_payloads:
        response = requests.post(
            f"{base_url}/api/comments",
            json={"content": payload},
            headers={"Authorization": "Bearer valid_token"}
        )
        # 响应中不应原样返回未转义的脚本
        assert '<script>' not in response.text
        assert 'onerror=' not in response.text

nmap -sV -p- 10.0.0.0/24   # 全端口 + 服务版本探测（内网授权环境）

// fuzz_test.go —— go test 会先跑种子用例，再自动变异探索
package parser

import "testing"

func FuzzParseAmount(f *testing.F) {
    // 种子输入：正常值 + 历史出过问题的边界值
    f.Add("100")
    f.Add("-1")
    f.Add("")
    f.Add("99999999999999999999")

    f.Fuzz(func(t *testing.T, s string) {
        v, err := ParseAmount(s)
        if err == nil && v < 0 {
            t.Fatalf("解析出负金额: %q -> %d", s, v)
        }
        // 不崩溃、不挂死、不变量不破，即为通过
    })
}

go test -fuzz=FuzzParseAmount -fuzztime=60s ./...

// fast-check：任意两个日期区间，先 serialize 再 parse 必须还原
import fc from 'fast-check';

test('日期序列化往返一致', () => {
  fc.assert(fc.property(fc.date(), (d) => {
    expect(parse(serialize(d))).toEqual(d);
  }));
});

# Hypothesis：性质同上
from hypothesis import given, strategies as st

@given(st.integers(min_value=0, max_value=10**9))
def test_amount_roundtrip(n):
    assert parse_amount(format_amount(n)) == n

传统模式：需求 → 设计 → 编码 → [测试] → 发布
测试左移：[需求评审] → [设计评审] → [TDD] → [持续测试] → 发布

# 依赖审计：--audit-level 决定阻断阈值
npm audit --audit-level=high
pip-audit -r requirements.txt --strict

# 秘密扫描：对整个历史扫描一次，之后在 CI 只查增量
gitleaks detect --source . --report-path leaks.json

# idor_test.py：两个账号互相越权的最小断言集
import requests

BASE = "https://test.example.com"

def login(user):
    r = requests.post(f"{BASE}/api/login", json=user, timeout=5)
    return r.json()["token"]

alice = {"username": "alice", "password": "Alice#123"}
bob = {"username": "bob", "password": "Bob#12345"}

def test_alice_cannot_read_bob_order():
    alice_token = login(alice)
    bob_token = login(bob)
    bob_order_id = requests.get(
        f"{BASE}/api/orders", headers={"Authorization": f"Bearer {bob_token}"}, timeout=5
    ).json()[0]["id"]
    resp = requests.get(
        f"{BASE}/api/orders/{bob_order_id}",
        headers={"Authorization": f"Bearer {alice_token}"}, timeout=5,
    )
    assert resp.status_code in (403, 404), f"越权成功: {resp.status_code}"
    assert "bob" not in resp.text.lower()   # 拒绝响应也不应泄露对方数据